CVE-2014-8684

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 71.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-09-19 · updated 2026-06-17
Weakness: CWE-310

Description

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Affected products

CodeIgniter4: through 2.2.6
Kohanaframework Kohana: 3.2.3, 3.3.0, 3.3.1

References

http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
http://seclists.org/fulldisclosure/2014/May/54
https://github.com/kohana/core/pull/492
https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
http://seclists.org/fulldisclosure/2014/May/54
https://github.com/kohana/core/pull/492
https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection

Get alerted when CVE-2014-8684 or the next vulnerability affects your stack